diff --git a/CHANGELOG.md b/CHANGELOG.md index d5eb12b..e97879b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -34,6 +34,7 @@ - **tracker:** No need to explicit serialize announce data ### Refactor +- **Tracker:** Better Tracker behaviour in multi tracker - **View:** Rename folder `error` to `action` - **action_success:** Simple The Action Template diff --git a/framework/Http/Session.php b/framework/Http/Session.php index 37d71fd..f7e217d 100644 --- a/framework/Http/Session.php +++ b/framework/Http/Session.php @@ -142,4 +142,10 @@ public function getSessionId() return $this->_sessionId; } + public function setCsrfToken() + { + $csrf = StringHelper::getRandomString(16); + $this->set('csrf', $csrf); + return $csrf; + } } diff --git a/framework/Validators/CsrfTrait.php b/framework/Validators/CsrfTrait.php new file mode 100644 index 0000000..a13f31c --- /dev/null +++ b/framework/Validators/CsrfTrait.php @@ -0,0 +1,25 @@ +getData('csrf'); + $csrfText = app()->session->pop('csrfText'); + if (strcasecmp($csrfInput, $csrfText) != 0) { + $this->buildCallbackFailMsg('csrf', 'csrf verification failed.'); + return; + } + } +}